sds: clusters and listeners read static secrets from Bootstrap.static_resources

ci/do_circle_ci.sh

@@ -4,7 +4,7 @@ set -e
 
 # bazel uses jgit internally and the default circle-ci .gitconfig says to
 # convert https://github.com to ssh://git@github.com, which jgit does not support.
-mv ~/.gitconfig ~/.gitconfig_save
+# mv ~/.gitconfig ~/.gitconfig_save
 
 export ENVOY_SRCDIR="$(pwd)"
 

include/envoy/secret/BUILD

@@ -0,0 +1,24 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "secret_interface",
+    hdrs = ["secret.h"],
+)
+
+envoy_cc_library(
+    name = "secret_manager_interface",
+    hdrs = ["secret_manager.h"],
+    deps = [
+        ":secret_interface",
+        "//source/common/json:json_loader_lib",
+        "@envoy_api//envoy/api/v2/auth:cert_cc",
+    ],
+)

include/envoy/secret/secret.h

@@ -0,0 +1,59 @@
+#pragma once
+
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "envoy/common/exception.h"
+#include "envoy/ssl/context.h"
+
+namespace Envoy {
+namespace Secret {
+
+/**
+ * Secret contains certificate chain and private key
+ */
+class Secret {
+public:
+  virtual ~Secret() {}
+
+  /**
+   * @return a name of the SDS secret
+   */
+  virtual const std::string& getName() PURE;
+
+  /**
+   * @return a string of certificate chain
+   */
+  virtual const std::string& getCertificateChain() PURE;
+  /**
+   * @return a string of private key
+   */
+  virtual const std::string& getPrivateKey() PURE;
+};
+
+typedef std::shared_ptr<Secret> SecretPtr;
+
+typedef std::unordered_map<std::string, SecretPtr> SecretPtrMap;
+
+typedef std::vector<SecretPtr> SecretPtrVector;
+
+/**
+ * Throws when the requested static secret is not available
+ */
+class EnvoyStaticSecretException : public EnvoyException {
+public:
+  EnvoyStaticSecretException(const std::string& message) : EnvoyException(message) {}
+};
+
+/**
+ * Throws when the requested dynamic secret is not available
+ */
+class EnvoyDynamicSecretNotReadyException : public EnvoyException {
+public:
+  EnvoyDynamicSecretNotReadyException(const std::string& message) : EnvoyException(message) {}
+};
+
+} // namespace Secret
+} // namespace Envoy

include/envoy/secret/secret_manager.h

@@ -0,0 +1,38 @@
+#pragma once
+
+#include <google/protobuf/util/json_util.h>
+
+#include <iomanip>
+#include <sstream>
+#include <string>
+
+#include "envoy/secret/secret.h"
+
+#include "common/json/json_loader.h"
+
+namespace Envoy {
+namespace Secret {
+
+/**
+ * A manager for all static secrets
+ */
+class SecretManager {
+public:
+  virtual ~SecretManager() {}
+
+  /**
+   * Add or update static secret
+   *
+   * @param secret Updated Secret
+   * @return true when successful, otherwise returns false
+   */
+  virtual bool addOrUpdateStaticSecret(const SecretPtr secret) PURE;
+
+  /**
+   * @return the static secret for the given name
+   */
+  virtual SecretPtr getStaticSecret(const std::string& name) PURE;
+};
+
+} // namespace Secret
+} // namespace Envoy

include/envoy/server/BUILD

@@ -95,6 +95,7 @@ envoy_cc_library(
         "//include/envoy/local_info:local_info_interface",
         "//include/envoy/ratelimit:ratelimit_interface",
         "//include/envoy/runtime:runtime_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/ssl:context_manager_interface",
         "//include/envoy/thread_local:thread_local_interface",
         "//include/envoy/tracing:http_tracer_interface",
@@ -171,6 +172,7 @@ envoy_cc_library(
     hdrs = ["transport_socket_config.h"],
     deps = [
         "//include/envoy/network:transport_socket_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/ssl:context_manager_interface",
         "//source/common/protobuf",
     ],

include/envoy/server/instance.h

@@ -11,6 +11,7 @@
 #include "envoy/network/listen_socket.h"
 #include "envoy/ratelimit/ratelimit.h"
 #include "envoy/runtime/runtime.h"
+#include "envoy/secret/secret_manager.h"
 #include "envoy/server/admin.h"
 #include "envoy/server/drain_manager.h"
 #include "envoy/server/hot_restart.h"
@@ -113,6 +114,11 @@ class Instance {
    */
   virtual ListenerManager& listenerManager() PURE;
 
+  /**
+   * @return the server's secret manager
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
+
   /**
    * @return the server's CLI options.
    */

include/envoy/server/transport_socket_config.h

@@ -3,6 +3,7 @@
 #include <string>
 
 #include "envoy/network/transport_socket.h"
+#include "envoy/secret/secret_manager.h"
 #include "envoy/ssl/context_manager.h"
 
 #include "common/protobuf/protobuf.h"
@@ -27,6 +28,11 @@ class TransportSocketFactoryContext {
    * @return Stats::Scope& the transport socket's stats scope.
    */
   virtual Stats::Scope& statsScope() const PURE;
+
+  /**
+   * @return Secret::SecretManager& reference of the SecretMangaer instance.
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
 };
 
 class TransportSocketConfigFactory {

include/envoy/ssl/BUILD

@@ -29,6 +29,7 @@ envoy_cc_library(
     deps = [
         ":context_config_interface",
         ":context_interface",
+        "//include/envoy/secret:secret_manager_interface",
         "//include/envoy/stats:stats_interface",
     ],
 )

include/envoy/ssl/context_manager.h

@@ -2,6 +2,7 @@
 
 #include <functional>
 
+#include "envoy/secret/secret_manager.h"
 #include "envoy/ssl/context.h"
 #include "envoy/ssl/context_config.h"
 #include "envoy/stats/stats.h"
@@ -49,6 +50,11 @@ class ContextManager {
    * Iterate through all currently allocated contexts.
    */
   virtual void iterateContexts(std::function<void(const Context&)> callback) PURE;
+
+  /**
+   * Return the secret manager
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
 };
 
 } // namespace Ssl

source/common/config/bootstrap_json.cc

@@ -5,6 +5,7 @@
 #include "common/config/cds_json.h"
 #include "common/config/json_utility.h"
 #include "common/config/lds_json.h"
+#include "common/config/tls_context_json.h"
 #include "common/config/utility.h"
 #include "common/json/config_schemas.h"
 #include "common/protobuf/utility.h"
@@ -130,5 +131,22 @@ void BootstrapJson::translateBootstrap(const Json::Object& json_config,
   }
 }
 
+void BootstrapJson::translateStaticSecretsBootstrap(
+    const Json::Object& json_secrets, envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
+
+  for (const Json::ObjectSharedPtr& secret : json_secrets.getObjectArray("secrets")) {
+    secret->validateSchema(Json::Schema::SECRET_SCHEMA);
+
+    auto secret_object = bootstrap.mutable_static_resources()->mutable_secrets()->Add();
+    secret_object->set_name(secret->getString("name"));
+
+    if (secret->hasObject("tls_certificate")) {
+      TlsContextJson::translateTlsCertificate(*secret->getObject("tls_certificate"),
+                                              *secret_object->mutable_tls_certificate());
+    } else if (secret->hasObject("session_ticket_keys")) {
+    }
+  }
+}
+
 } // namespace Config
 } // namespace Envoy

source/common/config/bootstrap_json.h

@@ -23,6 +23,14 @@ class BootstrapJson {
    */
   static void translateBootstrap(const Json::Object& json_config,
                                  envoy::config::bootstrap::v2::Bootstrap& bootstrap);
+
+  /**
+   * Translate static secrets to v2 envoy::config::bootstrap::v2::Bootstrap.
+   * @param json_config source static secrets.
+   * @param bootstrap destination v2 envoy::config::bootstrap::v2::Bootstrap.
+   */
+  static void translateStaticSecretsBootstrap(const Json::Object& json_secrets,
+                                              envoy::config::bootstrap::v2::Bootstrap& bootstrap);
 };
 
 } // namespace Config

source/common/json/config_schemas.cc

@@ -1678,4 +1678,19 @@ const std::string Json::Schema::SDS_SCHEMA(R"EOF(
     "required" : ["hosts"]
   }
   )EOF");
+
+const std::string Json::Schema::SECRET_SCHEMA(R"EOF(
+  {
+    "$schema": "http://json-schema.org/schema#",
+    "type": "object",
+    "properties": {
+      "name": {"type": "string"}
+    },
+    "required": [
+      "name"
+    ],
+    "additionalProperties": true
+  }
+  )EOF");
+
 } // namespace Envoy

source/common/json/config_schemas.h

@@ -54,6 +54,8 @@ class Schema {
   static const std::string CDS_SCHEMA;
   static const std::string SDS_SCHEMA;
 
+  static const std::string SECRET_SCHEMA;
+
   // Redis Schemas
   static const std::string REDIS_CONN_POOL_SCHEMA;
 };

source/common/secret/BUILD

@@ -0,0 +1,31 @@
+licenses(["notice"])  # Apache 2
+
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+envoy_package()
+
+envoy_cc_library(
+    name = "secret_impl_lib",
+    srcs = ["secret_impl.cc"],
+    hdrs = ["secret_impl.h"],
+    deps = [
+        "//include/envoy/secret:secret_interface",
+        "//source/common/filesystem:filesystem_lib",
+        "@envoy_api//envoy/api/v2/auth:cert_cc",
+    ],
+)
+
+envoy_cc_library(
+    name = "secret_manager_impl_lib",
+    srcs = ["secret_manager_impl.cc"],
+    hdrs = ["secret_manager_impl.h"],
+    deps = [
+        ":secret_impl_lib",
+        "//include/envoy/secret:secret_manager_interface",
+        "//include/envoy/server:instance_interface",
+    ],
+)

source/common/secret/secret_impl.cc

@@ -0,0 +1,35 @@
+#include "common/secret/secret_impl.h"
+
+#include <string>
+
+#include "common/common/assert.h"
+#include "common/filesystem/filesystem_impl.h"
+
+namespace Envoy {
+namespace Secret {
+
+SecretImpl::SecretImpl(const envoy::api::v2::auth::Secret& config)
+    : name_(config.name()),
+      certificate_chain_(readDataSource(config.tls_certificate().certificate_chain(), true)),
+      private_key_(readDataSource(config.tls_certificate().private_key(), true)) {}
+
+const std::string SecretImpl::readDataSource(const envoy::api::v2::core::DataSource& source,
+                                             bool allow_empty) {
+  switch (source.specifier_case()) {
+  case envoy::api::v2::core::DataSource::kFilename:
+    return Filesystem::fileReadToEnd(source.filename());
+  case envoy::api::v2::core::DataSource::kInlineBytes:
+    return source.inline_bytes();
+  case envoy::api::v2::core::DataSource::kInlineString:
+    return source.inline_string();
+  default:
+    if (!allow_empty) {
+      throw EnvoyException(
+          fmt::format("Unexpected DataSource::specifier_case(): {}", source.specifier_case()));
+    }
+    return "";
+  }
+}
+
+} // namespace Secret
+} // namespace Envoy

source/common/secret/secret_impl.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include "envoy/api/v2/auth/cert.pb.h"
+#include "envoy/secret/secret.h"
+
+namespace Envoy {
+namespace Secret {
+
+class SecretImpl : public Secret {
+public:
+  SecretImpl(const envoy::api::v2::auth::Secret& config);
+
+  virtual ~SecretImpl() {}
+
+  const std::string& getName() override { return name_; }
+
+  const std::string& getCertificateChain() override { return certificate_chain_; }
+
+  const std::string& getPrivateKey() override { return private_key_; }
+
+private:
+  const std::string readDataSource(const envoy::api::v2::core::DataSource& source,
+                                   bool allow_empty);
+  const std::string getDataSourcePath(const envoy::api::v2::core::DataSource& source);
+
+private:
+  std::string name_;
+  std::string certificate_chain_;
+  std::string private_key_;
+};
+
+} // namespace Secret
+} // namespace Envoy